---
description: Finland git/CI/Telegram vs Iran app runtime topology
alwaysApply: true
---

# Infra topology (Finland vs Iran)

Ghabilee product apps (backend, admin, frontend) follow this split:

| Concern | Where |
| --- | --- |
| Git (`git.ghabilee.ir`) + Gitea Actions runners | **Finland** |
| All Telegram ops / deploy notifications | **Finland** (Actions secrets `TELEGRAM_*`, send from the runner) |
| App runtime (Docker Compose, Postgres, Redis, nginx, uploads) | **Iran** VPS |

## Rules for agents

- Do **not** send Telegram from the Iran VPS (`api.telegram.org` is unreachable there).
- Do **not** `source` full backend `.env` in shell notify paths (cron globs like `BOOKING_EXPIRY_CRON=*` break `sh`).
- Do **not** run heavy `docker build` / `next build` on the Iran box by default (OOM risk on small VPS).
- CI deploy should **build on Finland**, transfer the image to Iran, then `compose up` on Iran.
- Secrets: `VPS_*` = Iran runtime SSH; `FINLAND_*` = Finland build SSH; `TELEGRAM_*` = notify from Finland.
- Exception: `telegrambot` / telegram-relay **runs on Finland** (that is intentional).